Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b370bb3e4d5bc2dbddc11d6a9d3263a71d8ec67cd23e1d510f78a5b0a17f7b1c

  • Size

    128KB

  • Sample

    220926-zsgjracaa8

  • MD5

    d12a94ceeea6d180171e87c529e229da

  • SHA1

    0081ef3d81851a16adbae7954cf2f9df52156723

  • SHA256

    b370bb3e4d5bc2dbddc11d6a9d3263a71d8ec67cd23e1d510f78a5b0a17f7b1c

  • SHA512

    9f4b336b6556a7ff44ba965513b7f533f42c05041ea776f0a796160d6ca73dcf60c53041806797d93e23f629a244a2b724318bd702e1dd6aa3bf08fa120856a6

  • SSDEEP

    3072:LgwZOT551mJex7AfR9BVmOgTTFucZzGnGL5B:srmcitUxBuS

Score
10/10
redlinesmokeloaderlogsdiller cloud (tg: @mr_golds)backdoordiscoveryinfostealerspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @mr_golds)

C2

77.73.134.27:7161

Attributes
  • auth_value

    4b2de03af6b6ac513ac597c2e6c1ad51

Targets

    • Target

      b370bb3e4d5bc2dbddc11d6a9d3263a71d8ec67cd23e1d510f78a5b0a17f7b1c

    • Size

      128KB

    • MD5

      d12a94ceeea6d180171e87c529e229da

    • SHA1

      0081ef3d81851a16adbae7954cf2f9df52156723

    • SHA256

      b370bb3e4d5bc2dbddc11d6a9d3263a71d8ec67cd23e1d510f78a5b0a17f7b1c

    • SHA512

      9f4b336b6556a7ff44ba965513b7f533f42c05041ea776f0a796160d6ca73dcf60c53041806797d93e23f629a244a2b724318bd702e1dd6aa3bf08fa120856a6

    • SSDEEP

      3072:LgwZOT551mJex7AfR9BVmOgTTFucZzGnGL5B:srmcitUxBuS

    Score
    10/10
    redlinesmokeloaderlogsdiller cloud (tg: @mr_golds)backdoordiscoveryinfostealerspywarestealertrojan

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks